Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Reversing some Android malware I see that it sets android:priority to 10000 in the AndroidManifest.xml file. Looking at the Android Documentation I see that it needs a value > -1000 and < 1000.
How does this work? Is 10000 a valid priority value? Are there legitimate applications that use that priority value?
The Android documentation does, indeed, specify SYSTEM_HIGH_PRIORITY = 1000 and SYSTEM_LOW_PRIORITY = -1000. Those are guidelines, though: the IntentFilter source code doesn't actually check the priority. This means the actual range is from -2,147,483,648 to 2,147,483,647.
By using a very high value the malware can guarantee to run its receiver before any other. Since it doesn't follow the guidelines, it shouldn't be used in production/not malicious code.
MAX_INT is only done by malware, I was pointing out the reason why the malware is using it. It's still an hack though, and should be avoided if other options exist (for example, it won't work if two SMS apps use this trick - the one installed first will get it because same-priority receivers are handled in that order).
Sep 8, 2016 at 18:55